The LA‑Studio Element Kit for Elementor plugin contains a missing authorization vulnerability that permits exploitation of incorrectly configured access control security levels. The flaw affects versions up to 1.6.2. This enables attackers to bypass the intended authorization checks. The vulnerability is identified as CWE‑862.

WordPress sites that have the LA‑Studio Element Kit for Elementor plugin installed and active on any version 1.6.2 or earlier are affected. The vendor is LA‑Studio and the product is the Element Kit plugin for Elementor.

The CVSS base score of 5.3 indicates moderate severity. The EPSS value of less than 1% indicates a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. The likely attack vector, based on the description, is remote exploitation via unauthenticated HTTP requests to the plugin’s administrative or configuration endpoints that lack proper access control.